Investigation shows that the scheme is provable security under the blockwise adaptive attack model if the underlying block cipher is a pseudorandom permutation.